Assess vulnerability and rate the attack

What the unit asks

The draft points to a rating scheme that runs from minimal through basic, enhanced-basic, moderate and high to beyond high. The chosen level answers the question of what the system is expected to resist, and it belongs in the report before the result. Credential stuffing, hill climbing against a model and document forgery are as much a part of the picture as a face mask.

What good practice looks like

Build the scenario list from the threat model, the incident history and the fraud patterns the sector sees. Rate each scenario. State the level. Record the scenarios ruled out and why. A vulnerability finding is a finding even when the functional test passed.

Evidence an assessor asks for

What a good answer sounds like

A good answer to P3-12 names The attack scenario register, with the rating and the control for each., dates it, and says what it does not cover. A policy or a promise is not an answer. If P3-12 has no artefact, the row is not met and the absence is the finding.

Where comparisons commonly fail

• The report gives a pass and no scenario list.
• The attack potential is not stated, so the result cannot be compared.
• The open findings are left out of the executive summary.

Questions to put to the supplier

1. What attack potential was this system tested to?
2. Which scenarios were excluded, and who decided?

How this is used in the kit

P3-12 becomes one row of the comparison register, with an owner, a status and the evidence named above. A status of met asks for the artefact and its date, and the free check uses the same row as an evidence question, so the page and the register share one vocabulary.